CONTRAIL SECURITY. Contrail Cloud Networking & Security

Transcription

1 CONTRAIL SECURITY Aniket Daptari Sr. Product Manager Contrail Cloud Networking & Security Scott Sneddon Senior Director Cloud and SDN

2 This statement of direction sets forth Juniper Networks current intention and is subject to change at any time without notice. No purchases are contingent upon Juniper Networks delivering any feature or functionality depicted in this presentation. This presentation contains proprietary roadmap information and should not be discussed or shared without a signed non-disclosure agreement (NDA).

3 AGENDA PROBLEM STATEMENTS (Why) PRODUCT OVERVIEW (What) POLICY FRAMEWORK (How) 3 Copyright 2017 Juniper Networks, Inc.

4 WHY CONTRAIL SECURITY? 4 Copyright 2017 Juniper Networks, Inc.

5 Threats, Malwares, etc Challenges of Traditional Security Paradigm The Security Scale Challenge Policy explosion What to protect 1. Applications 2. Number of endpoints 3. Environments dev, prod, staging, onprem, public cloud, 4. What to protect against: 1. Data leaks 2. DDoS 3. Malware 4. Hacks 5. Viruses 6. Spyware, etc Applications, Tiers, Environments Security is Perimeter based but perimeter is everywhere Explosion in # of apps, endpoints, environments on the one hand Explosion in # of threats, malware, spyware, hacking, attacks, data leaks on the other hand Results in Policy explosion management complexity and nightmare Manual, error prone and non-automated. Does not scale. 5 Copyright 2017 Juniper Networks, Inc.

6 PROBLEM STATEMENT C u r r e n t B e h a v i o r D e s i r e d B e h a v i o r App1, Deployment = Dev Can we use one policy to be applied in all the different deployments? Network Policy = P1 App1, Deployment = Staging Network Policy = P2 App1, Deployment = Prod Network Policy = P3 App1, Deployment = Dev App1, Deployment = Staging App1, Deployment = Prod Policy = P 1. Reduced Complexity 2. Simplified Management 3. Improved Scalability 6 Copyright 2017 Juniper Networks, Inc.

7 PROBLEM STATEMENT Reuse of policies across multiple clouds and with multiple orchestrators App1, Deployment = Dev Define/Review/Approve Once Use Everywhere App1, Deployment = Dev-AWS App1, Deployment = Staging Policy = P App1, Deployment = Dev-K8s App1, Deployment = Prod B a r e M e t a l S e r v e r s App1, Deployment = Staging-BMS App1, Deployment = Dev-Mesos 7 Copyright 2017 Juniper Networks, Inc.

8 PROBLEM STATEMENT A Kubernetes application developer creates labels for K8s pods Can the security admin overlay his policies transparent to the developer [i.e. use the same (or different) labels to create security policies / boundaries ]? Kubernetes Application created by Developer (uses different labels to imply connectivity characteristics) CSO / Compliance / Operators puts policies (using the same or different labels seamless to developer) K8s Pod App 1 K8s Pod App 1 K8s Pod App 2 K8s Pod K8s Pod K8s Pod app" : app1" "tier" : frontend" "tier" : backend" "tier" : frontend" Policy 8 Copyright 2017 Juniper Networks, Inc.

9 WHAT IS CONTRAIL SECURITY? 9 Copyright 2017 Juniper Networks, Inc.

10 ENFORCEMENT DEFINITION CONTRAIL SECURITY KEY CAPABILITIES Consistent Intent- Driven Policy Application Policy Config & Flow Visualization Multiple Enforcement Points Security Admin No Policy Rewrite Define Once Enforce Everywhere Discover Inter- and Intra-application traffic flows with/without enforcing policies L4 L7 Web App DB Single policy OpenStack Controller Site = US Host-Based FW How to extend the same set of policies to Mesos, AWS, Kubernetes, Bare Metal Servers without policy rule explosion Offer visualization, analytics, and orchestration for security configurations Provide reporting, troubleshooting and compliance L4 Enforcement at the vrouter (Kernel, DPDK, vcenter, Smart NIC) L7 enforcement at the L7 Firewall 10 Copyright 2017 Juniper Networks, Inc.

11 Dev USE-CASE SCENARIO POLICY FRAMEWORK 1 allow https-traffic tier=web > tier=app match deployment 2 allow mysql-traffic tier=app > tier=db match site App = Finance, Deployment = Dev App = Finance, Deployment = Dev Web App Web App Production Staging E n f o r c e m e n t D e f n && site App = Finance, Deployment = Prod Web App Legacy Data (tier = db) App = Finance, Deployment = Staging Web App Legacy Data (tier = db) site = US site = EMEA 11 Copyright 2017 Juniper Networks, Inc.

12 TAGS & OTHER POLICY ITEMS Various ways to tag the workloads 1. Application = HRMS, CRM, 2. Deployment = Dev, QA, Staging, Production 3. Site = India, US, EMEA, etc 4. Tier = Web, App, DB, Label = anything custom Custom Tags User User Role OS Software Compliance Customer Compute Node: e.g. used in affinity / anti-affinity policies for compute Rack POD Cluster DC Phase 1 Deliverables Roadmap Address Group Can be used as an end-point in the policy 1. Prefixes 2. Static Group of IP Addresses 3. Dynamic Groups with custom labels 4. Service Group List of Protocol & port (e.g. web-service) 1. tcp tcp Application Policy Group List of policies make it an application set This helps in easy attachment to any application Firewall Policy 1 2. Firewall Policy Copyright 2017 Juniper Networks, Inc.

13 POLICY KEY ITEMS TO NOTE Policy Example: allow http-traffic tier=web > tier=app match deployment && site Tag expression Tag expression Tag key expression Policy Tags Tags / Labels Policy Enforcement Objects at different levels can be tagged Tags can be defined at different levels Global Project Network VM / Container / BMS Interface Policies will finally be enforced at the interface level 13 Copyright 2017 Juniper Networks, Inc.

14 VISUALIZATION 14 Copyright 2017 Juniper Networks, Inc.

15 POLICY & FLOW VISUALIZATION 15 Copyright 2017 Juniper Networks, Inc.

16 E n f o r c e m e n t D e f i n i t i o n MULTIPLE ENFORCEMENT POINTS Controller (HA enabled, logically centralized unit) Can run on VMs or bare Metal On-prem / public cloud / SaaS Offers Connectivity, Security Policies & Analytics / AppFormix Network devices - with - FER node L3-GW at MX L3-GW at Spine L2L3-GW at TOR Bare Metal Compute - with - Forwarding, Enforcement & Reporting (FER) node Virtualized Compute (Kernel / DPDK, vcenter) - with - FER node Smart NIC - with - FER node Public Cloud Instance - with - FER node Low latency connectivity 16 Copyright 2017 Juniper Networks, Inc.

17 KEY TAKEAWAY App Discovery, Tag based Policy & Visualization across heterogeneous and distributed environments (ESXi & KVM VMs, K8s / containers, bare-metal servers, Public Cloud, etc.) Network / Policy Framework Analytics & Monitoring Custom Custom Uniform and Consistent Network Virtualization, Application Security; Single Pane of Glass Visibility, Analytics and Monitoring 17 Copyright 2017 Juniper Networks, Inc.

18 RECOGNITION AT 2017 ONUG Blog: Contrail Security wins 2017 ONUG Innovation Award! 18 Copyright 2017 Juniper Networks, Inc.

19